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The search for "a quantum needle in a quantum haystack" is a metaphor for the problem of 
finding out which one of a permissible set of unitary mappings — the oracles — is implemented by a 
given black box. Grover's algorithm solves this problem with quadratic speed-up as compared with 
the analogous search for "a classical needle in a classical haystack." Since the outcome of Grover's 
algorithm is probabilistic — it gives the correct answer with high probability, not with certainty — the 
answer requires verification. For this purpose we introduce specific test states, one for each oracle. 
These test states can also be used to realize "a classical search for the quantum needle" which 
is deterministic — it always gives a definite answer after a finite number of steps — and faster by a 
factor of 3.41 than the purely classical search. Since the test-state search and Grover's algorithm 
look for the same quantum needle, the average number of oracle queries of the test-state search is 
the classical benchmark for Grover's algorithm. 

PACS numbers: 03.67.Ac 



I. INTRODUCTION 

In recent decades, the quantum theory found another 
practical use in the field of quantum information process- 
ing: Quantum computation [B-S] and quantum informa- 
tion theory [JJ [S] arc extensively researched by several 
scientific communities. On one hand, the superposition 
principle of quantum mechanics speeds up the computa- 
tion for important classes of computational problems. On 
the other hand, entanglement assists us in sending infor- 
mation from one place to another in a secure way. Both 
branches — quantum computation and quantum informa- 
tion theory — are interlinked and are grovifing rapidly. 

"Searching an item in a given database" is a well- 
known computational problem which has been studied 
with different conditions in both classical [5] and quan- 
tum 7J contexts. When an unsorted database stored in 
the memory of a classical computer (CC) is given, then 
the average number of iterations required by the CC to 
complete this classical search grows linearly with the to- 
tal number of items present in the database. But, if the 
items are already present in an order in the memory, then 
the average number of iterations scales up logarithmically 
with respect to the total number of items. 

Grover introduced a quantum search algorithm [7] for 
an analogous "quantum search problem:" A quantum 
computer (QC) searches a particular ket out of a set of 
kets from the computational basis. Or, more precisely, 
the quantum search finds which one of a set of unitary 
mappings — the oracles — is implemented by a black box. 
One can tackle this problem like its classical analog by 
testing for each oracle one by one in a sequence till the 
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match is found. Alternatively, we can exploit the super- 
position principle and address all the oracles simultane- 
ously, with Grover's search algorithm (GA). This gives a 
quadratic speedup to GA in comparison with the classical 
search. 

But the answer returned by GA is the correct one with 
a high probability only, not with certainty. It is, there- 
fore, necessary to verify the answer. This verification is 
done with the aid of the test states that we introduce 
here, one test state for each oracle. 

The test states can also be used for a classical-type 
search of the quantum data set (that is, the set of or- 
acles). Such a test-state search is deterministic — it will 
give the correct answer after a finite number of queries — 
and the average number of queries is proportional to the 
number of permissible oracles, but fewer by a factor of 
3.41 than the average number of queries for the cor- 
responding classical search of an unstructured classical 
database. 

A single iteration of the test-state approach is a three- 
step process. First, we prepare a test state, which is 
a certain superposition of all the kets of the set under 
search. Second, we pass it through the oracle — the very 
same oracle that is employed by GA. Finally, we retrieve 
the information by a measurement on the processed test 
state. As is the case in the classical search, this mea- 
surement says "yes" or "no" if the test state matches the 
oracle or not. In marked contrast to the classical search 
problem, however, there are different "no" answers de- 
pending on the actual oracle, and the measurement ex- 
tract the available information. The choice of test state 
for the next round is then guided by this information, 
and this guidance leads to a substantial reduction of the 
average number of trials needed before successful termi- 
nation of the search. 

The structure of this article is as follows. Section [ll] 
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comprises of the definitions and the algorithms for the 
search problem in both classical and quantum contexts. 
In Sec. |III[ a comprehensive description of the test- 
state approach to the quantum search problem is pro- 
vided. GA with test-state verification is then discussed 
in Sec. |IV[ and Sec. |V] deals with alternative test-state 
search strategies. In Sec. |VI[ we describe the quantum 
circuit for the construction of the test state and for re- 
alizing the measurements. We conclude with a summary 
and discussion in Sec. |VII[ and two appendixes contain 
additional material. 



II. SEARCH PROBLEM 

Suppose someone gives us a list of one hundred names 
of different animals on a piece of paper, and ask where 
"Lion" appears on this list. If "Lion" appears exactly 
once on the list, and the list is not ordered in any obvious 
way, then we have to go through about fifty names on 
average before we find "Lion." For a search of this kind, 
neither a CC nor a QC can directly helps us, because the 
data (names) are given on a piece of paper. 

In order to use a CC or a QC for this kind of database 
search, first we have to convert the data into an accessible 
format. For example, in case of a CC for such a search, 
first we have to load the data (the given list) into the 
memory of a CC. However, we can find the name Lion 
in the process of converting the list of names into an 
electronic format (in terms of strings of bits) and storing 
them in the memory. So, neither a CC nor a QC is 
very helpful for a search of this kind. In other words, 
a CC (QC) is helpful for a database search only when 
the database is given in an electronic format (quantum 
format) . 

Furthermore, a QC also cannot search a classical 
database without a "quantum addressing scheme" [5] 
where the classical database is converted into a quantum 
format (in terms of quantum kets). So, the process of 
searching a marked string of bits with a CC in a classical 
database which is stored in the memory of a computer 
is called as classical search. Similarly, quantum search is 
a process where a QC searches a marked quantum state 
(or, rather, a particular unitary operation) out of a set of 
quantum states (or, rather, a set of unitary operations). 
Classical and quantum searches are analogous but not the 
same, their detailed description is given in the following. 

A. Classical search 

Suppose we have an unsorted database as a set 

= {0,--- ,N-1} (1) 

of a total of N items stored electronically in the memory 
of a CC. Each item is labeled by an index from to TV — 1 
and further represented by a n-bit string in binary repre- 
sentation. For convenience, we shall confine our attention 



to the case iV = 2" (0 = 00 • • • 0, TV - 1 = 11 • • • 1), but 
the following algorithms and the test-state approach can 
be implemented for an arbitrary value of N. 

Throughout the article we shall consider only the case 
of a single matching item. The task of the search problem 
is to recover the corresponding index (n-bit string) to the 
marked item at the end of computation. 

The method employed by a CC to solve the search 
problem is by checking every element of Sq one by one 
in a sequence till a match is found [6]. A single iter- 
ation of this classical algorithm is a three-step process 
given as follows. Step 1: The CC picks a n-bit string 
at random from the set as an input. Step 2: The 
CC checks whether or not this string matches with our 
query. Step 3: It produces an answer to the question in 
terms of "yes" or "no." If the answer is "yes," then the 
CC stops the computation and produces the string as the 
result, and the corresponding item will be the matching 
item. If the answer turns out to be "no," then the CC 
picks another string at random from the set Sq as an 
input, with items tested earlier excluded, and asks the 
same question. If the answer is again "no," then the CC 
repeats the above procedure until it hits the matching 
item. One of the main points in this classical algorithm 
is, "Every time the CC picks at random only one n-bit 
string, and its current guess does not depend on previous 
guesses" other than excluding them. In this way, a CC 
needs, on average, as many as 

queries of the database before it finds the matching item. 
This is an immediate consequence of the recurrence rela- 
tion 

N 

Gc{N + l) = l+j^Gc{N) for7V>l (3) 

that commences with Gc{i) = 0. 

Since Gc'{N) cx for iV ^ 1, this classical search al- 
gorithm is linear in the number of candidate items. If, 
rather than being unstructured, the data were sorted be- 
forehand, then the problem could be completed by a bi- 
nary search in approximately log2 A'^ iterations [B] . 



B. Quantum search 

In this section, an analogous quantum search prob- 
lem to the classical one and a brief description of GA 
[7] is provided. Throughout the text we represent the 
single-qubit Pauli vector operator a by {X, Y, Z) and the 
identity operator by /. 

In the step from classical to quantum, bits are replaced 
by qubits. So, for each index (n-bit string) j of Sq de- 
fined by Eq. ([!]) there exist a n-qubit quantum ket 
the so-called index ket. There is then a unitary opera- 
tion — the jth oracle — which gives a conditional phase 
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shift of TT to the index ket \j) only, 

0.-^(_j)b>O-Uj_2|j)(j| 



(4) 



where I = I**" is the identity operator in the A^- 
dimensional Hilbert space. 

One can define an analogous quantum search problem 



to the classical search problem of Sec. II A in the fol- 
lowing way: Suppose someone gives us a quantum black 
box, which is implementing one of the N different ora- 
cles, and asks us to find out which of the oracles is the 
case without actually opening the box and looking in- 
side. Clearly, we are not using QC to search a marked 
item in a classical database, but we are searching the in- 
dex ket corresponding to the given oracle. The question 
of how many queries of the database are now needed, 
reads "How many times must one use the quantum black 
box to find out the correct result?" 

The most efficient way of finding out which oracle is 
the actual one is GA [S'. GA begins by applying the 
Hadamard gate 



H ^{X + Z 



(5) 



to each qubit, after initially preparing the state with in- 
dex ket |0) = jO)*^". The operation H'^" creates a super- 
position of all the index kets of Sq with equal amplitude 

1/^/N. The next step is an application of the Grover iter- 
ation operator Q, geometrically it is a rotation composed 
of two reflection operations a.s G = VO. The operator 
O is the same quantum oracle (black box) defined by 
Eq. Q, whose unknown index we have to find. The dif- 
fusion operator T) gives an inversion about the average 



V = -H®'\I-2\0){Q\)H' 



(6) 



its central piece is the 0th oracle C°. 

GA is probabilistic in nature in the sense that, after 
applying Q several times, the probability of the privileged 
index ket becomes significantly higher than the probabil- 
ities of the other index kets. Finally, we read out the 
output by performing projective measurements on each 
qubit, and so find one of the index kets. After k applica- 
tions oi Q , we have [7 

p^^^ = sin((2fc + 1)6'a,)^ with sin 6lAr = 1/\/]V (7) 

for the probability that the oracle associated with the fi- 
nal output state is the one which the black box is execut- 
ing. Upon optimizing fc, GA solves the quantum search 
problem by using the black box only 



(8) 



Gq{N) = 0.69 ViV 



times when 1; see Sec. |IV| below. The quadratic 

speedup of Gq{N) oc y/N versus Gc{N) oc is owed 
to the computational power of quantum physics; specifi- 
cally, the superposition principle is at work. We empha- 
size that the outcome of GA is not guaranteed to be the 



correct answer; it can be incorrect with a probability that 
is very small but definitely nonzero. 

In passing, we note the following. A general treatment 
of GA for multiple targets and for an arbitrary value of 
A^ is given in Ref. [TU]. Moreover, GA is a special case of 
the quantum amplitude amplification [llj . In addition, 
one can get rid of the probabilistic nature of GA if one 
has the option of changing the structure of the diffusion 
operator V and the oracle O [12] . When one is only 
allowed to use the given black box, namely the oracles of 
Eq. Q, but not to look inside and change the setting, 
then GA remains probabilistic in nature. 

So, one needs a confirmation step to be sure of the 
result obtained by GA. A single iteration of the test- 
state search introduced in the next section acts as a con- 
firmation step for GA, where the verification matter is 



discussed after Eqs. (15). Details of GA with test-state 



verification are given in Sec. ^Vj 



III. TEST-STATE SEARCH 



In this section, we introduce the test-state approach 



to the quantum search problem described in Sec. II B 



where one has to identify the actual oracle which is im- 
plemented by the given black box. The features of both 
classical and quantum approaches are embodied in this 
approach. A single iteration in the test-state approach 
can be summarized in the following three steps. 

Step 1: We pick an index ket |j) and prepare the cor- 
responding test state. Step 2: We pass the test state 
through the given quantum black box which is execut- 
ing one of the oracles of Eq. Q. Step 3: We extract 
the information with the help of a particular probability- 
operator measurement (POM) [T21II1]. Here, a "single it- 
eration" comprises of these three steps, which are similar 
to the classical search algorithm of Sec. |II A[ The result of 
the POM gives an answer to the same question — whether 
or not the black box is executing the oracle — in terms 
of "yes" or "no." The answer "yes" tells us that the black 
box is executing the corresponding oracle to the index ket 
we picked, and we terminate the search. 

Even if the answer is "no," the result of the POM gives 
us some information about the actual oracle. This in- 
formation facilitates an educated guess and a judicious 
choice of the test state for the next iteration. 

The correct result is obtained after a finite number of 
iterations. In other words, the test-state search is deter- 
ministic, rather than probabilistic. And, the systematic 
educated guessing makes the test-state search more effi- 
cient than a truly classical search, in which all test states 
would be chosen at random: For A^ ^ 1, the test-state 
search needs fewer guesses by a factor of 3.41. 
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A. A single iteration in the test-state search 

In this section, we construct the test states for verifica- 
tion of the outcome of GA and discuss the three steps of 
one iteration round in the test-state approach to deter- 
mining the actual oracle of the quantum search problem. 
The narrative follows the steps in sequence. 

Step 1 — Preparing the test state: We pick an in- 
dex ket \j) from the set 



{io),...,b),...,|iv-i)} 



(9) 



of all index kets. For the very first round of iteration, 
the choice of \j) is random, but for all subsequent rounds 
the choice is dictated by the result of the measurement 
in Step 3, as discussed in Sec. |IIIB[ 

Then we prepare the corresponding test state \tj) 
which is of the form 



\tj) = a\j) +bJ2\l) 

1(^3) 



(10) 



where a is the amplitude of the privileged index ket |j) 
and h is the common amplitude of all other index kets. 
Both a and b are functions of iV; it suffices to consider 
only real positive values for a and 6, but this is a restric- 
tion of convenience, not of necessity. 

In Sec. |VI A[ we present a quantum circuit for con- 
structing the test state |to)- The test state |to) can be 
transformed into any other test state \tj) by applying the 
X operations on the relevant qubits. In other words, each 
\tj) is equivalent to |<o) up to some single-qubit opera- 
tions. 

Step 2 — Processing the test state: We pass the 
test state \tj) through the given quantum black box. We 
recall that the black box is implementing one of the N 
different oracles of Eq. Q, but we do not know which 
oracle is the case. If the black box is implementing the 
jth oracle, then the resultant state is 



10- 



(11) 



If the black box is not implementing the jth oracle, but 
some other one, the kth. oracle, say, then the resultant 

state is 



0%)^\t^^^a\J)-b\k)+h 



\l). (12) 



Result says "yes, it is the jth oracle" whereas each 
\t^) with k ^ j says "no, it is not the jth oracle," and we 
note that there is one "yes" but — 1 different "no"s. 
We define the "no" set to index ket \j) as the col- 



lection of all iV - 1 "no" states of Eq. (|12|), 



c. 



N 



At'-') 



In order to be able to distinguish the "yes" 
the "no" kets in Cj^ , we demand that 



(13) 
ket \t',) from 



{t';\t])^0 forfc^j, 



(14) 



so that the "yes" ket is orthogonal to all "no" kets. To- 
gether with the normalization of the test-state ket 
this gives 



a = V(A^-3)/(2iV-4), 
h = Vl/(2iV-4), 



(15) 



for the amplitudes in Eq. ( 10 ) 



The use of the test states for the verification of the 
outcome of GA, is quite obvious: After GA identifies the 
jth oracle, we prepare the jth test state \tj) and let the 
oracle act on it. Then we perform a measurement that 
determines whether the resulting ket is proportional to 
the "yes" ket or resides in the orthogonal subspace 
spanned by the iV — 1 "no" kets. If we find the "yes" 
ket, the search is over; otherwise, we have to execute GA 
another time. An alternative confirmation step for GA, 
where one has to use the black box at most two times, is 
described in Appendix [A] 



As Eqs. (15) show, there are test states for TV > 2, but 
none for N — 2. This is as it should be. For, the two 
N = 2 oracles 0° = |1) (1| - 10) (0| and = |0)(0|-|1)(1| 
are simply indistinguishable; they do not tell the index 
kets |0) and |1) apart. 

Turning our attention to the "no" kets, we observe that 
they are the edges of a (N — l)-dimensional pyramid. 



k^j,l^j: (tf|4) -A + (l-A)<5, 



kl 



(16) 



with A = (iV-4)/(iV-2). In the terminology of Ref. [15], 
the pyramid is acute (A > 0) for > 4, orthogonal 
(A = 0) for 4, and flat (A = -l/(iV-2)) for N = 3. 

The case = 4 is particular: We have a = & = 1/2 and 
all four test states are identical. The "no" states for one 
index ket are pairwise orthogonal; they are "yes" states 
for the other index kets. As a consequence, testing the 
oracle once with the one common test state will reveal 
its identity. 

This observation is sometimes stated as "GA needs 
to query the oracle only once for TV = 4." Indeed, we 



have p^^-* = 1 in Eq. ([7|. This peculiarity of GA comes 
about because the common A^ = 4 test state is also the 
N = 4 initial state of GA, and the A^ = 4 version of the 
diffusion operator V of Eq. Q maps the SRM kets of 
Eq. ( 18 ) below onto the computational basis, in which 



only 



the outcome of GA is obtained. 

Step 3 — Measuring the result: When measuring 
the state that results from applying the black-box oracle 
to the jth test state \tj), we not only need to distin- 
guish between "yes" and "no" but also want to acquire 
information about which of the "no"s is the case, so that 
we can make a judicious choice for the next test state. 
Thanks to the pyramidal structure of the "no" kets, the 
POM that maximizes our odds of guessing right is the 
so-called square-root measurement (SRM) [T5] . 

For A^ = 3, there is no useful POM of this kind because 
the two "no" states are the same, as is exemplified by 
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\tl) ^ -\tl). For iV > 3, the SRM 



N-l 

En. 

k=0 



(17) 



has the rank-1 outcomes E*^ = \Tf){Th with 



3 I J 

-1/2 



(=0 



for k = j 
b\j)-x\k)+y J2 10 for k^j 



where 



y = 



x = l-y 



(18) 



(19) 



and a, b are the coefiicients of Eqs. ( 10 1-( 12 ) and ( 15 1 
Since 



(20) 



the SRM is an orthogonal measurement, a standard von 
Neumann measurement, not a POM proper. Therefore, 
the SRM can be implemented by a unitary transfor- 
mation followed by measuring the computational basis. 
One quantum circuit for such a unitary transformation 
is given in Sec. |VIB| 



B. Conditional probabilities 

The probability of getting the Ith outcome if the pro- 
cessed jth test state is is given by 



prob(i^^n;) = (i^|n^|t^) = |(ijKf) 



(21) 



It follows from Eqs. (Ill, (12), and (181 that there are 
three cases, 



prob(t) 



where 



1 for k = j, I = k 

ajv-i for k =/= j, I = k 
Pn^i for k^ j, l^k 



72 



(22) 



N-l 



(iV- 1)2 



(23) 



with the subscript — 1 stating the number of different 
"no" outcomes. 



The first case in Eq. ( 22 ) is the affirmative "yes, it is 



the jth oracle" answer that terminates the search. The 



second and third cases both say "no, it is not the jth 
oracle." Thereby, the probability aN-i of getting the 
fcth outcome when the black box implements the fcth 
oracle is larger than the probability /^at-i for all other 
"no" outcomes. Upon finding the ^th outcome, we will 
therefore guess that the black box contains the Ith ora- 
cle and choose \ti) as the next test state. The choice of 
SRM maximizes the probability that this educated guess 
is right. 

After the first wrong guess \j), we exclude the index 
ket |j) from the list of candidates, and have the set 



i = {|0),...,b--l),|j + l),...,|iV-l)} (24) 



of the remaining iV — 1 index kets for the next round. 
Having found SRM outcome II' , we repeat the iteration 



described in Sec. 



Ill A 



on the set Sq ^ by taking the 
index ket \l) as the next educated guess, for which the 
"no" probabilities are aAr-2 and I3n-2- If this guess is 
also wrong, then the lih index ket can be excluded as well, 
and we are left with A*"— 2 candidates and a new educated 
guess for the next test state with "no" probabilities um-z 
and Pn-^- And so forth, until we either get the "yes" 
answer, or we are left with four candidates only, having 
excluded iV — 4 index kets successively. The common test 
state for N — A will then surely give us the "yes" answer; 
in the present context, this is confirmed by as = 1 and 
/33 = in Eqs. ([22]) and ([23|. 

In each round of iteration in the test-state search, we 
are using the black box once. Accordingly, the average 
number of oracle queries before a "yes" answer is ob- 
tained, is given by 



Gt{N)= pi""^ + 2pf ) + 3pl" ' + --- + iN- 3)p^^^ (25) 

where is the probability that the search terminates 
after the mth round. For iV > 4, these probabilities are 



AN) 



(N) 
Pi 

(N) 
P2 



1 

iV' 

(1-pl ')aN-i = ^ QjV-l, 



Pa - (1 - Pi -P2 )"W-2 

N -1. . 
= (1 - aAf-i)ajV-2, 



(26) 



p'.'l, - {I ^pf 



■P2 



Pn-5)0^5 



N - 1 
N 

-1 
N-l 
N 



(1 - Qjv-i) • • • (1 - ae)a'i 

Pn-3 — ^ Pi P2 Pn~4 

(1 - aN^i) • • • (1 - q;6)(1 - az). 



Without the educated guesses provided by the SRM, 
one would have to resort to choosing the test state for 
the next iteration at random, just as one does in a 
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purely classical search, which amounts to the replacement 
aL l/L and yields pf^ = p"^^ = ■■■ = p\^}^ = \/N, 

p^^l'j, — A/N. But with the systematic educated guesses, 
we have 



600 



tti « tor L':$> 1 . 

Li 



(27) 



and the probabilities for early termination arc substan- 
tially larger than 

Equations ( 25 ) and (l26|) yield the recurrence relation 



GT(A^ + l) = l + ^^(a^-/3N) + ^GT(iV), (28) 

which commences with Gt(4) = 1 and reduces, as it 
should, to its Gc analog in Eq. ([3| for aAr = /jjy = 1/iV. 



With the aid of the large-L form of az, in Eq. ( 27 1 and 



the corresponding statement for /3i, we then find that 
the average number of queries in the test-state search is 
given by 



N 



N 



4 + 78 6.83 
The comparison with the classical search 



for iV > 1 , 



GriN) 
G^) 



1 



V2 



1 

3^ 



for iV > 1, 



(29) 



(30) 



shows that the judicious choice of the next test state has 
a substantial pay-off: We need much fewer queries. 

Since the test-state search and GA are both determin- 
ing the actual oracle inside the quantum black box, the 
classical- type "yes/no" approach of the test-state search 
sets the benchmark for the quantum search with GA. 
It is true, that both Gc{N) and Gt{N) grow linearly 
with the number N of candidate items, whereas Gq{N) 
grows proportional to V N — and this quadratic speed- 
up is, of course, the striking advantage of the quantum 
search algorithm — but the reduction of the average num- 
ber of queries by the factor of 3.41 is truly remarkable by 
itself. It, too, is a benefit of the superposition principle. 
The three search strategies are compared in Fig. [l] which 
shows Gc{N), Gt{N), and Gq{N) as functions of N. 



IV. 



GROVER'S ALGORITHM WITH 
TEST-STATE VERIFICATION 



As recalled in Sec. |IIB| above, a single GA cycle con- 
sists of the preparation of the initial state, k applications 
oi G = VO, followed by a measurement in the computa- 
tional basis that is composed of the index kets. After the 
measurement finds index ket we apply the oracle to 
test state \tj), measure the resulting state with the SRM, 
and so decide whether the actual oracle is or not. The 
search terminates when this test says "yes." But if the 
reply is "no," we execute another GA cycle. 



G{N) 




200 400 600 800 1000 1200 

iV 

FIG. 1: Average number G{N) of oracle queries as a func- 
tion of the total number of index kets. Curve "a" shows 
Gc{N) of Eq. ([2| for the classical search strategy. Curve "b" 
shows Gq{N) of Eq. (34 1 for Grover's search algorithm, sup- 
plemented by test-state verification and optimized for least 
number of queries per search cycle. Curve "c" shows Gt{N) 
of Eq. (1281) for the test-state search. 



The probability that a GA cycle finds the correct index 
state is p^^^ of Eq. It follows that the probability 
that the search terminates after the mth cycle is 



COs((2fc + l)6lAr 

X sin((2fc + l)6iAr) 



2(m-l) 



(31) 



for m = 1, 2, 3, . . . . 

Each cycle queries the oracle k times, once for each 
application of G, plus one more time during the test-state 
verification. The verification is only done, however, if the 
result of the GA cycle is not an index state to an oracle 
that is already known to be wrong from the verification 
step of an earlier cycle. If the search terminates after the 
mth cycle, the oracle has been queried as many as 



mk + l + {N -I) 



1 - 



N -2 
N -1 



(32) 



times on average, where the last summand is the average 
number of wrong test states that are tried-out during the 
unsuccessful m — 1 preceding cycles. 

Accordingly, the average number that we need to query 
the oracle before we know which oracle is the actual one, 
is given by 



GQiN;k) 



(N) 
Pk 



1 + (iV - 2)p 



(N) 
k 



(33) 



This expression ignores the very small correction of no 
consequence that results from the possibility that the 
search can terminate after trying out — 1 test states 
for wrong oracles and so learning that the one remaining 
oracle must be the actual one. 
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In Gq{N] k), k is the number of oracle queries per cy- 
cle, so that we can optimize GA by minimizing Gq{N] k) 
with respect to fc, 



GQ(iV) = mm Gq (TV; fc). 
The asymptotic form of Eq. ([s]) is obtained from 



(34) 



N 



lim Gq{N)/Vn 



0/2 
(sin (py 



0.6900, (35) 



where = 1.1656 is the smallest positive solution of 
2(j) = tan0. For ^ 1, one needs (sin(/))~^ = 1.18 cycles 
on average before GA concludes successfully, and the op- 
timal k value is fc = ^cjy^/N — 0.58\/]V, which is slightly 

less than 75% of fc = ^ttVN, the value that maximizes 



the single-cycle success probability p^' 



(AT) 



ALTERNATIVE TEST-STATE SEARCH 
STRATEGIES 



where 2/{N — 2) is the success probability for the MUD 
to the {N — l)-edged pyramid of the \tj) kets with j ^ k 

m- 

The price for this increase of the bare 1/A^ probability 
is paid by getting an inconclusive result from the MUD 
if it fails to identify the right state, so that we have no 
information that would facilitate an educated guess for 
the next test state. The resulting average number of 
oracle queries is 



^(MUD).,,. _ (A^-l)(3jV + 4) 
127V 



(39) 



if we successively search in the relevant subspace only, 
and 



(MUD)' 



G 



with X 



(N) 



1 



1 X — X 



N+l 



1 



1-a; N {l~x)^ N 



7V-4 
N -2 



(40) 



The GA search of Sec. |IV| is consistently carried out 
in the full space spanned by all index kets, as requested 
by the standard form of GA that we accept as its def- 
inition. By contrast, the successive iteration rounds of 
the test-state search of Sec. lIIII are conducted in the rele- 
vant subspace spanned by the remaining candidate index 
kets. As a consequence of this systematic shrinking of the 
searched space, the successive educated guesses get bet- 
ter from one iteration round to the next. 

In actual implementations, however, it may not be 
practical to limit the search to the relevant subspace be- 
cause it is usually much easier to realize the necessary 
operations in the full N — 2" dimensional space; see 
Sec. IVII If all iteration rounds of the test-state search are 
indeed performed in the full space, we have 



1 1 



^'^^^^-i^x N{i-xr 

with X = {N - l)/?jv-i 



1 

— X 
N 



N-2 



(36) 



instead of Gt(A) of Eq. (jSgj). The large-A^ form thereof 
is 



e-'f - 1 



r 



6.08 



with J ^2 + Vs. 



Compared with the classical search, the reduction is still 
by more than a factor of 3, but the full-space test-state 
search needs about 12% more queries than the relevant- 
space search. 

One could wonder if there is a benefit in using the mea- 
surement for unambiguous discrimination (MUD) [T71fT5] 
rather than the SRM, because the MUD gives a small 
chance of identifying the actual oracle with a wrong test 
state. The probability of finding the right one of N ora- 
cles with a randomly chosen test state is then 



1 N -1 2 _ 3N ~ 
N ^ N TV- 2 ~ N{N ■ 



(38) 



if the search is consistently carried out in the full space. 
The large- forms 



Gf™)(A^) 



N 



G 



(MUD)' 



N 



4/(1 



A^ 

3^ 



(41) 



show clearly that this price is high: The test-state search 
with MUD needs substantially more oracle queries than 
the search with SRM. In addition, the MUD is a proper 
POM and more difficult to implement than the SRM. 

One could also rely on the MUD rather than the SRM 
in the verification step of GA. There are then modifica- 
tions in Eqs. (32) and (33), but the large- A^ statement of 
Eq. (35) remains the same. 



VI. UNITARY OPERATIONS FOR REALIZING 
THE TEST-STATE APPROACH 

While the test state |to) could be realized for any value 
of N, we deal only with the important case of A^ = 2" 
when the oracles are unitary operators acting on n qubits. 



(37) Then, the test states \tj) of Eq. (10 1 are locally equiva- 



lent to I to), in the sense that we can transform the test 
state l^o) into any other test state by applying X opera- 
tions on the relevant qubits. In Sec. |VI A| we describe a 
construction for |to), and show how to realize the SRM 
of Eqs. (fT7l)-(l20| in Sec. fVIB 



A. Construction of the test state 



as an 



Let us first take the case of three qubits (A^ : 
example; then a = ^5/12, b = ^1/12 in Eq. ( 10 ) with 
+ 7b^ = 1. For preparing the three-qubit test state 
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|0) - 

10) _ 



<>- 



V, - H 



H^o(8)) 



H 



(a) 



W, - H 



H 



rko(i6)) 



(b) 



FIG. 2: Quantum circuit (a) is for preparing of the three- 
qubit test state \to{8)) and (b) is for the four-qubit test state 
|to(16)), respectively. Here, the input state is |0)®" (n = 
3,4), the Hadamard operations are depicted by H, and the 
explicit forms of the various controlled gates (the Vs and Ws) 
are given in the text, where all single-qubit operations are Y 
rotations. 



|<o(8)), the input register is initialized in the state |0)^ 
and then the single-qubit gate 



-i9iY 



with tan 01 



2b 



1 



Va^ + 352 V2 



(42) 



is performed on the first qubit. Thereafter, we perform 
the controlled gate 



with tan0, = ^$SE^=2-V3 

(43) 

on the second qubit by taking the first qubit as control 
(with the control set to |0)) followed by the Hadamard 
gate H of Eq. ^ . Subsequently, we perform the doubly- 
controlled gate 



V. = e 



with tan O-i — 



a — b 3 — v5 



(44) 



on the third qubit by taking the first and second qubits 
as controls (with both controls set to |0)) followed by the 
Hadamard gate H . The over-all unitary operation u for 
the case of three qubits can be narrated as 

u^[l(g)I(g>H] [|00)(00|(8 V^3 + (/«)/- |00)(00|) (g)/] 
x[l(g)H(E)l] [{\0){0\(E)V2 + \l){l\(E)l)(E}l] 
X [Vi ® / ® /] , (45) 

and the corresponding quantum circuit is depicted in 
Fig-ia). 

The quantum circuit displayed in Fig. 2[b) is for the 
construction of the four-qubit test state fIo(16)), where 



v/13/28, b = ^1/28, and + 15b^ = 1. In this 



Wi = e-'"^'^ with tani9i = 



VSb 



and 



W2 



with tan i?2 



362 



362 



(46) 



26 _ 1 

Yb~i 

(47) 



as well as W3 = V2 and W4 — V3. 

The generalization to the n-qubit case is immediate. 
How to efficiently split a multi-qubit controlled unitary 
operation C"~^(V^) (single-qubit gate V with n — 1 con- 
trol qubits) in terms of universal gates with n — 1 work 
qubits is shown in Refs. [HlIIl], and its circuit complexity 
is of the order of n. Consequently, the circuit complexity 
for constructing the n-qubit test state with quantum cir- 
cuits of the kind shown in Fig.[2]is 0{n^). In Appendix[B| 
an alternative method for constructing the test state \to} 
is given, where the amplitudes a and b are complex num- 
bers. 



B. Realization of the SRM 



In order to perform the SRM of Sec. |III A| in the labo- 
ratory, one needs a unitary transformation 

M^^IO(r^| (48) 

1=0 

that turns each basis ket |Tq) into the corresponding ket 
|/) of the computational basis. With Eqs. (11) and (18) 



we have 

M = -Z+ (1 - a)|0)(0| + b{\0}{v\ + \v){0\)+y\v){v\ 
with It;) - 5] |fc) , (49) 



k=l 



which has one eigenvalue -1-1 and A'^ — 1 eigenvalues — 1, 
so that the unitary operators — M and the n-qubit- 
controlled-Z 



C"-^(Z) -2\N -1){N -l\ = O 



N-l 



(50) 



have the same set of eigenvalues, that is: they are uni- 
tarily equivalent. The eigenkets of M are 



|eo) 



1 - a 



|0) 



l + a 



|0) 



v/2(l + a) 



1 

71^ 



|e,) = ^(-|l) + |j)) for J = 2,3,..., TV- 1, (5I) 
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Y- 



x}- u 



FIG. 3: The quantum circuit for the implementation of — M in 
the case of three qubits. The operation U is implemented by 



the circuit shown in Fig. |2 
in accordance with Eq. (153 



a) after changing the parameters 
And, if we run the same circuit 
in the reverse order we can also implement . The quantum 
gate shown in the center of circuit is the C^{Z) given by 
Eq. (ISOll. 



with M|eo) = |eo) and Mjej^o) — — |ej^o)- In view of 
the degeneracy of M, the set of orthonormal eigenkets for 
eigenvalue —1 is not unique, but the choice of Eqs. (51) 
is particularly useful in the present context. For, the 
eigenket |eo) has the same structure as the test state |to) 
of Eq. ( 10 1 , and we know from Sec. VI A how to construct 
\to)- 

We relate M to C" ^{Z) through the unitary operator 
XJ X^" that diagonalizes M in the computational basis, 



The operator U itself is such that U|0) 



18 ri 



(52) 



|eo; or 



ua:®"|i; 



(gin 



I Go), and we realize it by the circuit for 



u — see Fig. |2] — with the replacements 
b ^ 6/72(1 



a) , 



(53) 



while is implemented by the circuit that has the gates 
of Fig.[2]in reverse order and all respective 6 angle param- 
eters replaced by —6. Accordingly, all unitary factors on 
the right-hand side of Eq. ( |52| ) have known realizations, 
as illustrated for = 2^ in Fig. [s] 

With the SRM measurement thus implemented and 
the corresponding test states of Sec. |VI A[ we can verify 
the GA outcome and complete the quantum search as 
discussed in Sec. |IV[ and we can also perform the full- 
space test-state search of Sec.|v] for which Eqs. (36) and 
(37) apply. Of course, there are implementations as well 



of the test states in successively smaller spaces and of the 
corresponding SRM measurements, but we are not aware 
of economic implementations. The restriction to the sub- 
spaces of yet-to-probe index states is rather awkward in 
practice. 



VII. SUMMARY AND DISCUSSION 

We have introduced the test states that enable one to 
verify whether the outcome of a quantum search with 
the Grover's algorithm is the actual oracle or not. We 
thereby regard the search problem as defined by the set 



of possible oracles, which are those considered by Grover. 
Other search problems, such as the one studied by H0yer 
[12] . are not automatically covered as well; the corre- 
sponding test states — if they exist — have to be found for 
each search problem separately. That is also the case 
for Grover-type searches with more than one matching 
item, that is when the oracle is a product of two or more 
different unitary operators of the kind defined in Eq. (|4| . 

It is possible that there are no test states for some of 
these other search problems, in which case one may not 
be able to verify if the search was successful — neither by 
test states of some sort, nor by a method like the one de- 
scribed in Appendix \K\ below, nor by another procedure. 
This should make one wonder if a search problem is well- 
posed in the first place, if it is not possible to verify the 
outcome. We leave this as a moot point. 

With the test states at hand, we have the option 
of solving the quantum search problem with a classical 
search strategy. But there is a twist: While there is 
one "yes" answer, each "no" answer is slightly different 
and, with the help of the square-root measurement, this 
difference can be exploited systematically for a judicious 
choice of the test state for the next round. This educated 
guessing is rewarded by much fewer queries of the oracle 
on average than what one needs for the simple "yes/no" 
search. A reduction by a factor of 3.41 is achievable in 
principle, and a practical scheme still gains a factor of 
more than three. In our view, the classical-search bench- 
mark is set by the search that exploits the differences 
between the "no"s fully. 

The picture is completed by giving explicit circuits for 
the implementation of the n-qubit test states. The cir- 
cuit complexity is of order , and a variant of the same 
circuit is the main ingredient in the realization of the 
square- root measurement. 
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Appendix A: An alternative confirmation step for 
Grover's algorithm 

Here we describe an alternative procedure for verify- 
ing the result obtained by GA. This method does not 
rely on the construction of test states. Rather it employs 
a simple circuit that distinguishes between two selected 
"target oracles" and the other N — 2 oracles. The veri- 
fication is achieved by having the GA-outcome oracle in 
two different target pairs, and thus requires two queries 
of the oracle. 

Suppose GA has had oracle as the outcome. The 
corresponding index ket \j) = \xix) has value xi for the 
first qubit and the values of qubits 2,3, . . . , n are sum- 
marized by the string x- We pair |j) with \j) = \xix) 
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FIG. 4: A single iteration of the alternative confirmation is 
exhibited in terms of quantum circuit diagram. The input 
state with ket \4>i-n) ~ \0x) of Eq. (A2l is passed through the 
sequence of the Hadamard gate H of Eq. ([5|, the quantum 
black box, and another Hadamard gate. Finally, the 1st qubit 
of the output state |(;/>out) is measured in the computational 
basis. 



where 



Xi 



xi + l (mod 2) 



lif xi = , 
if xi = 1 , 



(Al) 



so that j and j differ in the first bit value only. 

As indicated in Fig. |4] we prepare qubit 1 in the state 
with ket |0), and encode the x part of the index state in 
qubits 2 through n. So, the ket of the n-qubit input state 
is 



\<f>in) = |0X) = 



0, 
1. 



(A2) 



We pass it through the quantum circuit of Fig. |4j where 
the given black box is used only once. If the black box 
is implementing either oracle or oracle , then the 
output state will have ket 



(A3) 



If, however, the black box is implementing one of the 
other TV — 2 oracles, the output state will have ket 



|0x) 



(A4) 



Finally, qubit 1 is measured in the computational basis. 
If we find 0, the "no" output is the case, and we can be 
sure that the actual oracle is neither nor . But 
when we find 1, we know that one of these oracles is inside 
the black box. We determine which one by pairing \j) 
with a third index ket that also differs only by the value 
of one qubit, which then plays the role of the privileged 
qubit in the corresponding circuit of the kind depicted in 
Fig. [4j where qubit 1 is singled out. 

So, we either get a definite "no" answer to the question 
"Is the jth or the jth oracle the case?" or we are told 
"yes, it is one of these two." In the latter situation, we 
know for sure which one it is after a second round. 



Appendix B: An alternative construction of the test 
states 



In Sec. VI A[ we gave a construction of the test states 
of Eq. ( 10 ) with the real coefficients a and b of Eq. ( 15 1. 
Here, we provide an alternative method by which one 
produces the alternative test states with complex a and 
b amplitudes, as exemplified by 



\to) - a|0>+6^ 10 
1=1 

= (a-&)|0)®" + 6\/iV|^\^" 



(Bl) 



where |+) = H\0) = (|0) + \1))/V2 uses the Hadamard 
gate of Eq. ([5]), and the absolute values \a\ and |6| are, 
of course, still those of Eq. ([I5|. As before, it is enough 
to show how l^o) is made, the other test states are then 
available by applying some single-qubit X gates. 

We obtain a ket of this kind by applying the multi- 
Hadamard unitary operator 



C^^H."ifW=cxpH0i?«72), 
to |j=0) = |0)»", 



7-7-12. ..Tl 



cos - |0)«" 



(B2) 



(B3) 



Now, for by/N ^ -i sm{0/2) = -i^N/{2N - A) we need 
to set the angle parameter 6 to the value determined by 



tan - 
2 



N 



and one verifies that 



—;= sm - 



V2iV-4 



(B4) 



(B5) 



also has the absolute value required by Eq. ( 15 1. So, if we 



set 9 in accordance with Eq. (B4), then the output state 
of Eq. ([B3]) is the test state of Eq. (|B1]). We note 
that 6* = TT for = 4, and 9 = 11/2 + 2/N for A^ > 1. 

One can execute the unitary operation U]^^'"^ j^{9) on 
the n-qubit input state lO)**" by a similar method as the 
one given for the unitary operation C^2z'.'."z(^) ^^c. HA 
of Ref. . Here, the input quantum register of n qubits 
(circles in Fig.[5]Ji)) and the ancilla qubit 'r' (diamond in 
Fig. p[i)) are initialized in the n-qubit input state with 
ket lO)**" and the state with ket \+)r, respectively. Then, 
similar to the n cz operations in Sec. HA of Ref. [20], 
here we perform the n controUed-Hadamard operations 



CH 



W-(|o)(o|)^0/^" + (|i>(i|)^®i?' 



(B6) 



between the ancilla qubit and each one of the n qubits. 
All the controlled-Hadamard operations represented by 
the bonds in Fig. [5f^i) can be carried out at the same 
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FIG. 5: (Color online) (i) The "star graph; 
graph state with the ket |<?!>)(i+ 



(B7l 



stands for the 
The (blue) 



^) of Eq, 

circles represent the n qubits which carry the input ket |0) 
the bonds are established by the controUed-Hadamard gates 
CH(n) of Eq. ( |B6[ ), and the ancilla qubit 'r' is represented by 
the (black) diamond. Plot (ii) represents the net effect on 
the input ket |0)®", when the ancilla qubit is measured in an 
appropriately chosen basis. 



time, because they all commute with each other. This 
leads us to the resultant star-graph state with the ket 



1 



(|0),®|0)^" + |1).® 1+)®") 



(B7) 



IW(l+n) - 

The subscript I + n reveals the number of qubits of the 



final graph state. 

A single-qubit projective measurement on the ancilla 
qubit V in the basis 

6 

|t(6', ^Tr))^ = cos-|0),. + isin-|l)^, 

\iie,^n))r = -sin^|0), + zcos^|l), (B8) 
transforms the input ket of the n qubits into the ket 

lout) = (i?®")'"'^C/HV."H(^)|0)®" . (B9) 

Here, S {0, 1} is the measurement result, and 

(i?'*")™'' is the byproduct operator [HI [55], which is 
represented by the dotted boxes on all the n qubits in 
Fig.gii). 

After undoing the effect of the byproduct operator in 
Eq. ([B9|), one has the test state of Eq. (Bl |, and can then 



apply the necessary single-qubit X gates to get the test 
state that one needs. Alternatively and more efficiently, 
one can combine these X gates with the byproduct op- 
erator and execute the resulting single-qubit gates in one 
go. 
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